Lock a user account (admin only)
POST
/users/{userId}/lock
Prevents the user from signing in. Requires admin role. Returns 422 if the admin attempts to lock their own account. Creates an audit trail entry recording who locked the account and when.
Authorizations
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
Account locked successfully
application/json
JSON "toast": { "title": "Account locked.", "message": [ "Account jane.doe@example.org locked." ], "variant": "success" }, "user": { "id": 42, "name": "Jane Doe", "email": "jane.doe@example.org", "admin": false, "locked_at": "2026-05-28T15:00:00Z" }
{
}